Shell must have been a little shocked to hear a database of its entire staff directory – all 170,000 employees – had been emailed to environmental and human rights groups.

But it’s not clear, as Ed Crooks writes on ft.com, exactly who leaked it; although it claims to be a group of 116 employees, who are apparently concerned about Nigeria:

The e-mail sets out a four-stage strategy for raising awareness of allegations about Shell’s practices in Nigeria, including campaigns to target the media and institutional investors.

It also advocates “having people from NGOs [non-governmental organisations] becoming full-time (undercover) employees of corporations (in western countries)” to campaign for change in corporate practices.

Meanwhile John Donovan at royaldutchshellplc.com is irked, because he says Shell asked him not to make the directory public for security and personal reasons (he agreed); but the company subsequently told the press, including the FT, that the database leak was not a security risk. We don’t necessarily agree with Donovan’s accusation that the Shell staff in question were deliberately misleading anyone. Indeed the directory doesn’t contain personal home contact details, so opinions probably varied. But to say there are no security implications from such a leak isn’t quite correct.

Because leaked staff directories are not as safe as handing out business cards. The reason is: social engineering.